CGNAT & Lawful-Intercept Logging for ISPs: Stay Compliant
IPv4 exhaustion pushed almost every ISP onto Carrier-Grade NAT (CGNAT), where many subscribers share a single public IPv4 address. That solves address scarcity but creates a compliance problem: when authorities send a lawful request tied to a public IP, timestamp and port, you must be able to say exactly which subscriber was behind it.
The CGNAT Traceability Problem
Under CGNAT, a public IP alone is not enough to identify a user. Identification requires the full tuple: public IP + source port range + timestamp, mapped back to the subscriber's private/CGNAT session. Without deterministic mapping or logging, that link is lost.
How ISPs Stay Traceable
- Deterministic NAT / port-block allocation — assign each subscriber a fixed range of ports so a public IP+port maps to one subscriber without per-flow logs.
- Session logging — record CGNAT translations (who got which public IP/port block, and when) with accurate timestamps.
- Subscriber correlation — tie every session to the RADIUS/PPPoE account, so a query resolves to a named customer.
- Retention policy — keep logs for the legally required period, then purge — no more, no less.
Answering a Legal Request
A compliant workflow lets an authorized operator take a public IP, port and timestamp and return the responsible subscriber — with an audit trail of who ran the query and when. Access must be restricted, logged, and used strictly for lawful requests.
Compliance Is Local
Data-retention periods and lawful-intercept obligations differ by country and are set by law and your regulator. This article is operational guidance, not legal advice — confirm the exact retention window and process with your legal counsel and national framework before you rely on any configuration.